6
$\begingroup$

I've been thinking about the following set-up involving three parties, Alice, Bob and Charlie:

  • Bob and Charlie decide among themselves who is going to receive a bit from Alice (perhaps by a coin toss)
  • Some protocol is then executed in which Alice transfers a bit to the decided on person.

The protocol is defined as secure if:

  • Alice cannot change her bit based on which of Bob or Charlie it is that receives the bit (the transfer is "party independent")
  • Supposing Bob was decided on to receive the bit, Charlie cannot learn the value of the bit handed over by Alice, and vice versa.

My question is this: is there a studied task which is similar to what is described above? Or is this perhaps secretly equivalent to some apparently distinct task? (it sounds a bit like some form of oblivious transfer)

Improve this question
$\endgroup$
4
  • 1
    $\begingroup$ Couldn't Alice just commit to a bit, give the commitment to both Bob and Charlie, then only reveal the bit to whichever of them was decided to receive it? $\endgroup$
    – Joseph Sible-Reinstate Monica
    Commented Mar 1, 2017 at 5:05
  • $\begingroup$ Is Alice allowed to know who receives the bit? Say Bob is suppose to receive the bit, can Charlie collude with Alice to prove to her that Bob received it and not Charlie? $\endgroup$
    – mikeazo
    Commented Aug 8, 2017 at 18:09
  • $\begingroup$ @Joseph Sible, yes, in the context of a classical bit commitment scheme that seems right to me, which is an interesting point. That said, I'm working in a context where security should be based on physical restrictions only, ie those coming from quantum mechanics and special relativity. In that context we don't have bit commitment in the hand-commitment then hand reveal sort of form. $\endgroup$
    – Alex May
    Commented Aug 20, 2017 at 22:45
  • $\begingroup$ @mikeazo, I'm playing with definitions here so you could imagine various versions, but as I was thinking of it I'm allowing Alice to know whatever, including who ends up receiving the bit, so long as the transfer remains "party independent". $\endgroup$
    – Alex May
    Commented Aug 20, 2017 at 22:47

1 Answer 1

Reset to default
1
$\begingroup$

You can get active security in cryptographic setting, but it seems that you also need broadcast.

  1. Bob and Charlie both create an asymmetric key.
  2. Bob commits to his public key a broadcasts the commitment.
  3. Bob sends its public key to Charlie and opens the commitment to him. If these do not match, Charlie complains.
  4. Charlie broadcasts both keys (in random order). If Bob's isn't one of them, he complains by opening the commitment.
  5. Alice picks one key at random, encrypts the message, and broadcasts the result. Only one of them is able to decrypt, and Alice doesn't know who.

Note that the message space should be large, otherwise Bob can just try to encrypt all possible messages with Charlie's key and see which one was broadcast. To remedy this, apply some random padding to the message.

Also note that in step 3, the accusation does not lead to identification of the culprit.

Improve this answer
$\endgroup$
1
  • $\begingroup$ This answer forces it to be random whether Bob or Charlie receive the message, but the question specified that Bob and Charlie should be able to decide this among themselves. $\endgroup$
    – Joseph Sible-Reinstate Monica
    Commented Sep 25, 2021 at 17:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.